IBM Troubleshoot: Logging Problems in IBM WebSphere Application Server - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Trace analysis information for the logging component in the WebSphere® Application Server.

SYMPTOM
Does not display.

RESOLVING THE PROBLEM

This document contains troubleshooting information for logging problems in the WebSphere® Application Server. This can help address common issues with this component before calling IBM support and save you time.

TAB NAVIGATION
 *
 *
 * Troubleshoot- selected tab,
 *
 * Collect data [http://www.ibm.com/support/docview.wss?uid=swg21321060]

Overview
You will find common questions in this section that may help resolve your logging problems.

1. How do I use JCL with WebSphere® Application Server?

For information on how to use JCL, see The Support Authority: Using Jakarta Commons Logging (JCL) with WebSphere Application Server [https://www.ibm.com/developerworks/websphere/techjournal/0901_supauth/0901_supauth.html]

2. What are IBM recommendations regarding SLF4J and Logback?

In general, we recommend that customers use JUL when possible/practical (as mentioned in The Support Authority: A developer's guide to WebSphere Application Server logging [http://www.ibm.com/developerworks/websphere/techjournal/0802_supauth/0802_supauth.html]). JUL provides a good, ubiquitous logging infrastructure, which is suitable for most applications, and integrates with WebSphere Application Server log and trace. Using JUL directly also avoids extra log/trace API "hops" that are introduced by using other log/trace frameworks that map to JUL. The WAS logs are generated using JUL Handlers connected to the root JUL Logger.

In case you don't want to use JUL, or you have code that is already instrumented with another logging package, SLF4J or Logback can be helpful. For example, you may have code already written with Log4J. Log4J log/trace is not routed to WAS log/trace files, and Log4J loggers don't show up in the WAS tree of loggers you can control from the admin console. Further, trace spec settings you make in WAS do not control Log4J logger settings. This is where SLF4J or Logback can come in handy, as you can use them to intercept Log4J calls and forward them to the logging implementation of your choice. In order to integrate well with WAS logs/trace, we would recommend you bind your SLF4J/Logback API to map your log/trace content to JUL -- this will give you the ability to see your logs/trace in the WAS log/trace files, and enable you to have easy admin console control over all of your loggers.

3. How can I get WAS logs to go to syslog or the Windows EventLog?

There are a number of places that users have asked to be able to direct logs to in the past. Most notably, a number of customers have asked for the ability to send logs to syslog.

WebSphere Application Server sends all of its logs to java.util.logging (JUL), and customers can customize what happens to the log/trace events by way of using JUL Handlers. Once content is sent to JUL, it can be handled in a variety of flexible ways:

1) By default, we store the content in our log files, such as SystemOut.log, trace.log, or the newer log and trace repositories of the High Performance Extensible Logging framework we added in WebSphere Application Server V8.0. We also send the log content over JMX notifications, which allows for remote access.

2) If customers want to send content to places like SMTP, syslog, event log, or a few other places, they can use SLF4J to route WAS logs to Log4J, and use the corresponding Log4J Appenders. In this configuration, WAS logging routes to java.util.logging, SLF4J's Handler routes the request to Log4J, and Log4J can be configured to write log records to a syslog Appender.

3) If users want to do something even more custom, they can write their own JUL Handlers and plug them into WebSphere Application Server.

4. I am unable to turn on WebSphere Application Server trace. The trace state sets to *=off?

The systemOut.log shows:

[5/26/15 14:10:44:746 EDT] 000000d9 ManagerAdmin I TRAS0018I: The trace state has changed. The new trace state is *=off.
The problem is related to the below two JVM arguments:

-Djava.util.logging.configureByLoggingPropertiesFile=TRUE
-Djava.util.logging.config.file=<path>/logging.properties
Verify if the above 2 JVM arguments are configured. If yes, temporary disable it so WAS trace can be enabled.

5. The WebSphere Application Server logging has stopped, what may have caused this?

The user might have disabled the trace by setting trace output to none.

Setting runtime trace output to none impacts the JVM logs. To do that, the runtime trace spec will be set to *=off, which means to turn off all log levels. If customers just want to disable the trace for debug information only, we recommend setting the runtime trace spec, accordingly, instead of setting runtime trace output to none. For example, set to *=info, which is the default.

Verify if the commons-logging.jar and commons-logging.properties exist in the JVM classpath. If yes, suggest to remove it and put them inside the application (with parent_last setting) or put them in the isolated shared library.

6. How can I separate my logs into separate files for each application?

In WAS V8.5, we added the application name to log and trace records stored using HPEL (High Performance Extensible Logging). Since HPEL lets you format and filter your log content after it has been persisted to the HPEL log/trace repository, this lets you decide if you want to see your application content on its own (helpful for uncluttered debug of an application), or together with the application server log/trace content (helpful to see impact of server on applications, and vice versa).

For example, if you had 3 applications called app1, app2, and app3, you could create app specific logs as follows: WAS_INSTALL_ROOT\bin> logViewer -includeExtensions appName=app1 > app1.log
WAS_INSTALL_ROOT\bin> logViewer -includeExtensions appName=app2 > app2.log
WAS_INSTALL_ROOT\bin> logViewer -includeExtensions appName=app3 > app3.log
or see everything in one file as follows:

WAS_INSTALL_ROOT\bin> logViewer > all.log
7. How can I add my own java.util.logging.Handler to WAS?

To create a Handler you need to extend the java.util.logging.Handler class as follows (this example also shows how to filter for only the most severe messages):

import java.util.logging.Handler;
import java.util.logging.Level;
import java.util.logging.LogRecord;
public class MyHandler extends Handler {
public void close() {
}
public void flush() {
}
public void publish(LogRecord record) {
if (record.getLevel().intValue() >= Level.SEVERE.intValue()) {
// do something...
}
}
}
In your application you can add that Handler to the root logger as follows:
import java.util.logging.Handler;
import java.util.logging.Logger;
...
Handler myHandler = new MyHandler();
Logger logger = Logger.getLogger("");
logger.addHandler(myHandler);
...
8. Why can't I set my own log levels using the Logger setLevel method?

The application server can run in two modes.

By default, the logger levels are managed, and we expect any changes to logger levels to be done only through wsadmin or through the admin console. When the trace spec update is applied, we explicitly set each logger to the level specified in the trace spec -- we do not leave any named loggers at level set to null. So, while you can change a logger's level using the setLevel method, that change only lasts until you apply your next trace spec update from wsadmin or the admin console. Basically, changes you make via logger.setLevel are temporary at best, and do not apply automatically to children since the children won't have a null level.

Alternately, you can have the server to be configured by the JRE's logging.properties file by setting the java.util.logging.configureByLoggingPropertiesFile property. In this mode, the application server will not touch the logger levels -- you cannot update the levels through the admin console, nor through wsadmin. See Java virtual machine custom properties [http://www14.software.ibm.com/webapp/wsbroker/redirect?version=matt&product=was-base-dist&topic=xrun_jvm] for more information on this setting. In this mode, you can specify anything you would normally specify in your logging.properties file. Be careful not to use a console handler though, as that will lead to an infinite loop, since we take data sent to System.out, turn it into LogRecords, and send it to the root logger.
9. How can I get java.util.logging to initialize from a jre/bin/logging.properties file in the application server?

You can do this via system property: java.util.logging.configureByLoggingPropertiesFile=true

Note that if you do set up your server in this mode, we will not manage your logger levels via the admin console.

Note also that we will ignore any console handler entries found in the logging.properties file, since we route System.out to the root logger, which would mean that a console handler would cause an infinite recursion.

If you do use this system property, and you want to change logger levels, you have two choices:

 *
 * 2) Set the Logger levels programatically using the Logger.setLevel method

10. How can I get the full logger name from log and trace records?

The full logger name can be handy to know for enabling trace. How you get to it depends on what log and trace mode you use:

Basic log and trace mode:

The basic log format (not to be confused with basic log and trace mode), which is the default format for SystemOut.log / SystemErr.log / trace.log has a truncated version of the logger name:

[4/14/11 9:41:45:218 EDT] 00000021 QuickLogTest W hello fine 54857
There is no way to get the full logger name from basic formatted logs. You need to switch to advanced format for your logs/trace if you want to see the full logger name. Once in advanced format, log contents appear as follows:

[4/14/11 9:41:45:218 EDT] 00000021 W UOW= source=com.ibm.somelogger.QuickLogTest org= prod= component= thread=[WebContainer : 4]
hello fine 54857
HPEL log and trace mode:

You can use the HPEL LogViewer command line tool to output the log/trace content in either basic or advanced format.

> logviewer -format basic

....
[4/14/11 9:41:45:218 EDT] 00000021 QuickLogTest W hello fine 54857
....
> logviewer -format advanced

....
[4/14/11 9:41:45:218 EDT] 00000021 W UOW= source=com.ibm.somelogger.QuickLogTest org= prod= component= thread=[WebContainer : 4]
hello fine 54857
...
11. How can I write HPEL content to a database?

If you want to write to a Database, any of the following options will work:

1) Write your own log handler (that writes to a database) and plug it into JSR47. (see the Java doc for java.util.logging.Handler)

2) Write an HPEL reading Java application to read the content from an HPEL log repository and write it to a database

3) Write an HPEL reading Java application to read the content from an HPEL log repository and write it out in .csv format, then just use the common database commands to load the .csv content into the database.

12. How do you tune HPEL for optimal performance in tWAS?

In the server.xml, jvmEntries element:
- Ensure debugMode is set to false
- Ensure RAS JMX notifications are disabled by including -Dcom.ibm.ejs.ras.disablerasnotifications=true in genericJvmArguments
- Ensure -Xquickstart is not in the list of genericJvmArguments

<jvmEntries xmi:id="JavaVirtualMachine_1183122130078" verboseModeClass="false" verboseModeGarbageCollection="false" verboseModeJNI="false" runHProf="false" hprofArguments="" debugMode="false" debugArgs="-Dcom.ibm.ws.classloader.j9enabled=true -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=7777" genericJvmArguments="-Dcom.ibm.ejs.ras.disablerasnotifications=true">
In hpelModel.xml:
- Ensure textLog is disabled.

<hpelTextLog xmi:id="HPELTextLog_1" enabled="false" dataDirectory="${SERVER_LOG_ROOT}"/>
13. How can I tell who is writing to System.err / System.out ?

Add the following to your genericJvmArgument s :

-Xtrace:print=mt,trigger=method{com/ibm/ejs/ras/System*.*,jstacktrace}
14. How can I identify what code is writing to System.out.println?

Add the following to your genericJvmArguments and restart the server to see a stack trace for each call to System.out.println:

-Xtrace:print=mt,trigger=method{java/io/PrintStream.println,jstacktrace}
A snippet of the stack trace for a sample application, which calls System.out.println(), with the above JVM argument set, which identifies that the Hello.printHello (Hello.java:15) writes to System.out.

03:41:01.245*0x3277900 mt.0 > java/io/PrintStream.println(Ljava/lang/String;)V Bytecode method, This = 7fffff49f98
03:41:01.247 0x3277900 j9trc_aux.0 - jstacktrace:
03:41:01.248 0x3277900 j9trc_aux.1 - [1] java.io.PrintStream.println (PrintStream.java:829)
03:41:01.248 0x3277900 j9trc_aux.1 - [2] com.ibm.jvm.io.ConsolePrintStream.println (ConsolePrintStream.java:311)
03:41:01.250 0x3277900 j9trc_aux.1 - [3] Hello.printHello (Hello.java:15)
03:41:01.251 0x3277900 j9trc_aux.1 - [4] Hello.main (Hello.java:9)Hello World
03:41:01.253 0x3277900 mt.6 < java/io/PrintStream.println(Ljava/lang/String;)V Bytecode method
15. How can I see who called a particular method?

Add the following to your genericJvmArguments:

-Xtrace:print=mt,trigger=method{java/util/logging/Logger.setLevel,jstacktrace}
16. What are the .owner files for in the log directory?

The server creates a .owner file for each of the log files. The file content indicates which cell/node/server is the rightful user of the similarly named log file. This is used as a sort of locking mechanism to make sure that users don't improperly configure their systems. If two or more servers are configured to use the same log directory and file name, we can detect it using the .owner file and we will print a warning in the log file.

For more information, see Java virtual machine (JVM) log settings [http://www14.software.ibm.com/webapp/wsbroker/redirect?version=phil&product=was-nd-dist&topic=JVMLogs_description]

17. How can I correlate information from thread stacks in the javacore with information in my SystemOut.log file?

There are a few ways to correlate content in WAS logs/trace with content in javacore thread dumps:

Best option, if you are using WebSphere Application Server 8.0 / 8.5:

Applies to:
WAS 8.0.0.4 and above running with Java 626 SR4 and above
WAS 8.5.0.2 and above running with Java 7 SR3 and above or Java 626 SR4 and above

In recent releases, we have made it possible to have the thread id used in the WebSphere Application Server log/trace match with the thread id used in javacores. In WAS 8.0.0.4 and above, you can use a system property to make the thread id in the logs/trace match the Java thread id. In WAS 8.5.0.2 and above, the thread id used in the logs/trace matches with the Java thread id by default. For more information, see PM60913: Introduce ability to use Java Thread ID in Logs instead of LogRecord Thread ID [http://www-01.ibm.com/support/docview.wss?uid=swg1PM60913] and JVM log interpretation [http://www14.software.ibm.com/webapp/wsbroker/redirect?version=phil&product=was-nd-dist&topic=rtrb_readmsglogs]

Another option if you are using High Performance Extensible Logging (HPEL) / Binary Logging:

Applies to:
Full profile WAS 8.0.0.0 and above
Liberty profile WAS 8.5.5.0 and above

Full Profile:
Use the HPEL logViewer command to output the logs in advanced format so you can see the full thread name:
> logViewer -format advanced (basic is the default format)

Liberty Profile:
Use the binaryLog command line tool to output the logs in advanced format so you can see the full thread name:
> binaryLog view --format=advanced

You will get output that looks like the following:

[4/14/11 9:41:45:218 EDT] 00000021 W UOW= source=com.ibm.somelogger.QuickLogTest org= prod= component= thread=[WebContainer : 4]
The javacore contains the same thread name:

3XMTHREADINFO "WebContainer : 4" J9VMThread:0x1578D700, j9thread_t:0x150D0D04, java/lang/Thread:0x02517CE0, state:R, prio=5
3XMTHREADINFO1 (native thread ID:0x15B0, native priority:0x5, native policy:UNKNOWN)
3XMTHREADINFO3 Java callstack:
4XESTACKTRACE at com/ibm/io/async/AsyncLibrary.aio_getioev2(Native Method)
Another option if you are using Advanced format for your SystemOut.log / trace.log:

Applies to:
All currently supported WebSphere Application Server releases.

Change your log/trace format to Advanced. The Advanced format contains the full thread name, as does the javacore.

Advanced format Log:

[4/14/11 9:41:45:218 EDT] 00000021 W UOW= source=com.ibm.somelogger.QuickLogTest org= prod= component= thread=[WebContainer : 4]
The javacore contains the same thread name:

3XMTHREADINFO "WebContainer : 4" J9VMThread:0x1578D700, j9thread_t:0x150D0D04, java/lang/Thread:0x02517CE0, state:R, prio=5
3XMTHREADINFO1 (native thread ID:0x15B0, native priority:0x5, native policy:UNKNOWN)
3XMTHREADINFO3 Java callstack:
4XESTACKTRACE at com/ibm/io/async/AsyncLibrary.aio_getioev2(Native Method)
What to do next
If the preceding troubleshooting did not help solve your problem, see the Mustgather [http://www-01.ibm.com/support/docview.wss?uid=swg21321060]for logging problems to continue investigation.

Question:
Is there a way to separate the application logging from WebSphere Application Server logging?

Currently the WebSphere error logs as well as the application error logs are printed in same file. The same case with system out logs. Our goal is to separate the application system error and out logs from WebSphere system logs.

If we are use log4j in the application for separating the logs what is the best way to do this?

Answer: In WAS V8.5, we added the application name to log and trace records stored using HPEL (High Performance Extensible Logging). Since HPEL lets you format and filter your log content after it has been persisted to the HPEL log/trace repository, this lets you decide if you want to see your application content on its own (helpful for uncluttered debug of an application), or together with the application server log/trace content (helpful to see impact of server on applications, and vice versa).


IBM SSLKeyException: RSA premaster secret error  Caused by InvalidKeyException - United States JDBC JCC SSL SSLKeyException .InvalidKeyException TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 My java application using the Data Server Driver for JDBC (JCC) is failing to establish SSL connection with following error:

SSLKeyException: RSA premaster secret error. Caused by: java.security.InvalidKeyException: Illegal key size or default parameters.

SYMPTOM
javax.net.ssl.SSLKeyException: RSA premaster secret error. Caused by: java.security.InvalidKeyException: Illegal key size or default parameters

CAUSE
The default restricted policy file has a 2048 key size limit. If the RSA key size exceeds this limit then this error is expected.

RESOLVING THE PROBLEM
This issue can be resolved by upgrading to the unrestricted policy files, replacing the security policy files with the IBM unlimited cryptography files. Replace the local_policy.jar with the Unrestricted JCE policy File. [https://www14.software.ibm.com/webapp/iwm/web/reg/pick.do?source=jcesdk&lang=en_US]

Question:
Why am I getting an SSL Key Exception (RSA premaster secret error) when trying to create a syndication pair?

When trying to create the syndication pair for a virtual portal, I am getting the following exception:

"IWKWC0016E: The remote service can not be retrieved. Either the URL you entered is incorrect, the server you indicated does not contain IBM Web Content Manager or the web service has been incorrectly configured and could not be located. Check the log for more details https://1.23.456.789 <-- your ip address or hostname will be shown here

/wps/wcm/vpname/basicauth/SyndicationServlet?reqlocale=en_US& javax.net.ssl.SSLKeyException: RSA premaster secret error"

Answer: The default restricted policy file has a 2048 key size limit. If the RSA key size exceeds this limit then this error is expected.


IBM Enabling tracing for the DASH service in Jazz for Service Management - United States DASHL2; DASHL2FAQ; DASHL2MUSTG; enable tracing TECHNOTE (FAQ)

QUESTION
 What is the procedure to enable trace logging to troubleshoot DASH runtime issues/errors?

CAUSE
You can use trace logging to assist in monitoring system performance and diagnosing problems. Since trace logs can be quite verbose and include many unrelated errors, resetting the logs and then reproducing the problem issue can reduce the time required for log analysis for specific issues.

ANSWER
Steps to enable tracing:

Enable trace logging.

 1. Log into the DASH. After logging in navigate to Console Settings [/support/docview.wss?uid=swg21632844&aid=1] > Websphere Administrative Console.
 2. Navigate to Troubleshooting -> Logs & Trace
 3. Click on the Server1 -> Select Diagnostic Trace Service. Increase the Maximum Number of Historical Files from 1 to 10.
 4. Click Apply, then select Change Log Detail Levels.
 5. Click on Runtime tab to enable tracing for the DASH process that is currently running. Enabling tracing from the Runtime tab will keep tracing active until the next time the DASH server process is stopped. To make tracing persistent even after stopping and restarting the DASH server process click the Configuration tab instead.
 6. Clear the trace string in the Groups box and replace it with the following:

    *=info: com.ibm.isc.*=all: com.ibm.isclite.*=all: com.ibm.iscportal.*=all: com.ibm.isclite.service.datastore.consoleproperties.*=INFO

    For the Connection manager (data provider related issues) you will want to enable all for the following components:

    *=info: com.ibm.isclite.rest.*=all:com.ibm.tivoli.conmgr.*=all
 7. Click on the Apply button.
 8. If you enabled tracing from the Configuration tab in step 4, then click the "Save" link that appears at the top of the page. ("Save to master configuration")

Once tracing is enabled, reproduce the DASH runtime issue. Note the time that the issue was reproduced so that the issue can be easily correlated with the trace log entries.

Run the log collector program:

 1. Change the directory to <JazzSM Home>/ui/bin
 2. Run the following command:

    ./consoleLogCollector.sh or .bat

    Send us the console_logs.zip file located in <JazzSM Home>/ui directory

and attach them to the associated Problem Management Record (PMR). Please include the time the issue was reproduced in the PMR update. Please also provide the DASH version info:
<JazzSM Home>/ui/bin/consolecli.sh Version

Upload the resulting output file to the PMR

Question: Login to DASH  returned  "Page cannot be displayed" error Login to DASH  returned  "Page cannot be displayed" error

Answer:
Run the log collector program:

 1. Change the directory to <JazzSM Home>/ui/bin
 2. Run the following command:

    ./consoleLogCollector.sh or .bat

    Send us the console_logs.zip file located in <JazzSM Home>/ui directory

and attach them to the associated Problem Management Record (PMR). Please include the time the issue was reproduced in the PMR update. Please also provide the DASH version info:
<JazzSM Home>/ui/bin/consolecli.sh Version

Upload the resulting output file to the PMR


IBM Security Bulletin: IBM MQ Appliance is affected by a GNU C library (glibc) vulnerability (CVE-2017-8804) - United States  SECURITY BULLETIN

SUMMARY
 IBM MQ Appliance has addressed a vulnerability in GNU C library (glibc).

VULNERABILITY DETAILS
CVEID:CVE-2017-8804 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8804]
DESCRIPTION:glibc is vulnerable to a denial of service, caused by improper handling of buffer deserialization in the xdr_bytes and xdr_string functions. By sending a specially-crafted UDP packet, a remote attacker could exploit this vulnerability to cause virtual memory allocation, or memory consumption on the system.
CVSS Base Score: 7.5
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/125760 [https://exchange.xforce.ibmcloud.com/vulnerabilities/125760]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

AFFECTED PRODUCTS AND VERSIONS
IBM MQ Appliance 8.0

Maintenance levels between 8.0.0.0 and 8.0.0.7
IBM MQ Appliance 9.0.x Continuous Delivery (CD) Release

Continuous delivery updates between 9.0.1 and 9.0.3

REMEDIATION/FIXES
IBM MQ Appliance 8.0

Apply fixpack 8.0.0.8 [https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+MQ+Appliance+M2000&function=textSearch&text=8.0.0.8]
IBM MQ Appliance 9.0.x Continuous Delivery (CD) Release

Apply Continuous Delivery Release 9.0.4 [https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+MQ+Appliance+M2000&function=textSearch&text=9.0.4]

WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 04 December 2017 Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Security Bulletin: IBM MQ Appliance is affected by a GNU C library (glibc) vulnerability (CVE-2017-8804) I need to understand details regarding Security Bulletin: IBM MQ Appliance is affected by a GNU C library (glibc) vulnerability (CVE-2017-8804). Where can I find this information?

Answer:
CVEID:CVE-2017-8804 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8804]
DESCRIPTION:glibc is vulnerable to a denial of service, caused by improper handling of buffer deserialization in the xdr_bytes and xdr_string functions. By sending a specially-crafted UDP packet, a remote attacker could exploit this vulnerability to cause virtual memory allocation, or memory consumption on the system.
CVSS Base Score: 7.5
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/125760 [https://exchange.xforce.ibmcloud.com/vulnerabilities/125760]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)


IBM WebSphere Cast Iron Cloud integration fix packs are available - United States  NEWS

ABSTRACT
 Fix packs for WebSphere Cast Iron Cloud integration are now available for download.

CONTENT
Following are links to more information about the latest fix packs available on Fix Central for these versions:

 * 7.5.2.0 (App Connect Professional). See this forum Q&A [https://developer.ibm.com/answers/questions/303457/what-is-ibm-app-connect-professional/] for more information. And see App Connect Professional builds and iFix details. [http://www.ibm.com/support/docview.wss?uid=swg21998280]
 * 7.5.0.1 [http://www.ibm.com/support/docview.wss?uid=swg21972013]
 * 7.5.0.0 [http://www.ibm.com/support/docview.wss?uid=swg21963355]
 * 7.0.0.2 [http://www.ibm.com/support/docview.wss?uid=swg21686987]
 * 7.0.0.1 [http://www.ibm.com/support/docview.wss?uid=swg21678176]
 * 7.0.0.0 [http://www.ibm.com/support/docview.wss?uid=swg21656428]
 * 6.4.0.1 [http://www.ibm.com/support/docview.wss?uid=swg21647655]
 * 6.4.0.0 [http://www.ibm.com/support/docview.wss?uid=swg21641628]
 * 6.3.0.2 [http://www.ibm.com/support/docview.wss?uid=swg21650993]
 * 6.3.0.1 [http://www.ibm.com/support/docview.wss?uid=swg21625115]
 * 6.3.0.0 [http://www.ibm.com/support/docview.wss?uid=swg21619941]

Question: Where is latest information on fix packs for Cast Iron? Where can I find more information on the fix packs and downloads available for the various releases of Cast Iron?

Answer: Following are links to more information about the latest fix packs available on Fix Central for these versions:


IBM Specifying an alternative to "/tmp" for Tivoli Integrated Portal installs - United States TIPL2; TIPL2INST; tmp; temp directory; folder; Tivoli Integrated Portal; installation; fix pack TECHNOTE (FAQ)

QUESTION
 Is there a way to configure the TIP installer to use an alternate directory if the installation user ID has insufficient access rights to "/tmp"?

ANSWER
TIP L3 has examined the TIP installer and found that /tmp is hard coded in both the TIP and Websphere installers. There is no option available to override /tmp. To pursue a change to the TIP installer to accommodate an alternate tmp location, please submit an enhancement request via the RFE site here:

http://www.ibm.com/developerworks/rfe/?BRAND_ID=90 [http://www.ibm.com/developerworks/rfe/?BRAND_ID=90]

Question: Is there a way to force the Tivoli Integrated Portal (TIP) fix pack installer to use a different temp location? Is there a way to force the Tivoli Integrated Portal (TIP) fix pack installer to use a different temp location?

Answer: There is no option available to override /tmp.


IBM Can we remove world-writable permissions - global write permission - United States World writeable TECHNOTE (FAQ)

QUESTION
 Setup a recurring process to remove world-writable from the files and directories: chmod o-w. We are not planning to delete any files. Would this impact functionality ?

ANSWER
The question is whether or not it is safe to remove world-writable for these files and directories. Some of them are dynamic and will be re-created with world-writable after reboot. For these we would like to remove world-writable on a recurring basis.

/export/opt/IBM/tivoli/tip/derby/TTSS Directory-Only /export/opt/IBM/tivoli/tip/derby/TTSS/log Directory-Only /export/opt/IBM/tivoli/tip/derby/TTSS/seg0 Directory-Only /opt/tivoli/cit/bin/etc Directory-Only /opt/tivoli/cit/bin/etc/wscanhw Directory-Only /opt/tivoli/cit/cache_data Directory-Only /tmp/javasharedresources Directory-Only /usr/ibm/common/acsi/logs Directory-Only /usr/ibm/tivoli/common/CIT/logs Directory-Only /var/.com.zerog.registry.xml File /var/ibm/common/acsi/resourceBundleLocation Directory-Only /usr/ibm/common/acsi/repos/persistSVCRepos Directory-Only /usr/ibm/common/acsi/repos/persistSVCRepos/* File /usr/ibm/tivoli Directory-Only /usr/ibm/tivoli/common Directory-Only /usr/ibm/tivoli/common/CIT Directory-Only
Answer:

DB2 is OK confirmed by DB2 support
# Revoke world-writable from recurring DB2 log files
/bin/chmod o-w
/export/opt/IBM/home/tklmdb2/sqllib/db2dump/stmmlog/stmm.*.log
/bin/chmod o-w
/opt/IBM/home/tklmdb2/tklmdb2/NODE0000/TKLMDB/.SQLCRT.FLG
/bin/chmod o-w
/opt/IBM/home/tklmdb2/tklmdb2/NODE0000/TKLMDB/*/.SQLCRT.FLG

Tested removing world-writable permissions on DB2 and it is OK.

None of these files are TKLM specific.

Some of these directories do not belong to TIP.

CIT Files TKLM V2 doesn't have them:
/opt/tivoli/cit/bin/etc Directory-Only
/opt/tivoli/cit/bin/etc/wscanhw Directory-Only
/opt/tivoli/cit/cache_data Directory-Only
/usr/ibm/tivoli Directory-Only
/usr/ibm/tivoli/common Directory-Only
/usr/ibm/tivoli/common/CIT Directory-Only
/usr/ibm/tivoli/common/CIT/logs Directory-Only

Changed the permissions on those files. Everything looked OK: create a master keystore. create an LTO device. create a key, backup and restore, and apply a fixpack.

Non-DE
/tmp/javasharedresources Directory-Only
/var/.com.zerog.registry.xml File Can be deleted
DE related files
/usr/ibm/common/acsi/logs Directory-Only
/var/ibm/common/acsi/resourceBundleLocation Directory-Only
/usr/ibm/common/acsi/repos/persistSVCRepos Directory-Only
/usr/ibm/common/acsi/repos/persistSVCRepos/* File
** Remove world writable permissions from DE directories. This will not impact functionality.

It is OK to change the global write permission on above directories and files.

Question:
Can I remove the write permissions for "other" in ../ibm/common/acsi? Can I remove "write" permission for "other" for all the sub-directories and files under the following directory,

    /usr/ibm/common/acsi
    /var/ibm/common/acsi

Will it cause any problem?

Answer: Remove world writable permissions from DE directories. This will not impact functionality.


IBM MTTrapd [SNMP] probe drops traps from specific devices - United States nco_p_mttrapd; snmp; snmp traps; traps; dropped; drop; dropping; malformed; TCP TECHNOTE (FAQ)

QUESTION
 MMTrapd probe : Why are SNMP traps dropped from specific devices?

CAUSE
SNMP packets can be dropped for a number of reasons, including overloading, malformed packets, malformed traps/informs and incorrectly configured/non-compliant MIBS.

ANSWER
Traps can be dropped during high loading, so ensure that the traps are being dropped from specific devices under normal load.

Use snoop, tcpdump or Wireshark to capture the traps that are being dropped on the probe servers port, as defined in the property file.

e.g.
Port : 162

Load the PCAP file into the Wireshark GUI and review the trap[s] visually.

For traps to be processed they must have enterprise-oid and uptime, otherwise they will be dropped during probe processing by the NET-SNMP libraries.

Try setting Protocol to 'ALL' in case the trap is being sent as TCP|UDP.

For SNMPv3 trap and inform processing please refer to the available online FAQ's and supplementary documentation [see related information].

SNMPv3 traps require a unique creatruser entry for each device in the mttrapd.conf file, with the user definition including the devices unique engined-id. Whilst SNMPv3 INFORMs can be sent without an engine-id and a single createuser entry in the ConfPath's mttrapd.conf file.

If the trap appears to be RFC compliant, and MTTrapd probe is correctly configured, please send the PCAP file of the trap along with the probes debug log and property file to IBM Tivoli Netcool support for further analysis.

IMPORTANT: You should ensure that the latest MTTrapd probe and Netcool/OMNIbus fix pack is installed before contacting IBM Tivoli Netcool support, and that the problem persists with the latest product.

RELATED INFORMATION
#Capturing TCP data [http://www-01.ibm.com/support/docview.wss?uid=swg21569745]
Support's Guide to the SNMP [MTTrapd] probe [http://www-01.ibm.com/support/docview.wss?uid=swg21607690]
SNMPv3 trap reception [http://www-01.ibm.com/support/docview.wss?uid=swg21626348]

Question: OMNIBUS   nco_p_mttrapd : Malformed traps How can you determine why the MTTrapd [SNMP] probe drops traps?

Answer:
Traps can be dropped during high loading, so ensure that the traps are being dropped from specific devices under normal load.

Use snoop, tcpdump or Wireshark to capture the traps that are being dropped on the probe servers port, as defined in the property file.


IBM SPSS Student Version and Graduate Pack Resources - United States SPSS Support Acquisition Statistics Stats Grad Pack Student TECHNOTE (FAQ)

QUESTION
 Where do I get support for IBM SPSS Student Version or Graduate Pack software?

ANSWER
Step 1:
For installation & licensing issues on Student version and Graduate pack, contact your vendor.

 * Hearne [http://www.hearne.software/Software/SPSS-Grad-Packs-for-Students-by-IBM/FAQ]
 * On the Hub [http://onthehub.com/]
 * StudentDiscounts.com [http://studentdiscounts.com/contact-us.aspx]
 * JourneyEd [https://www.journeyed.com/contact]
 * thinkEDU [https://thinkedu.desk.com/]
 * Studica [http://www.studica.com/technical-support]

Cross reference information Segment Product Component Platform Version Edition Business Analytics SPSS Amos Windows Not Applicable Grad Pack, Shrinkwrap, Campus Business Analytics SPSS Modeler Platform Independent Not Applicable Business Analytics SPSS Text Analytics for Surveys Windows Not Applicable Business Analytics SPSS Statistics Platform Independent Not Applicable Campus Edition, Grad Pack, Student Version

Question:
How do I transfer my SPSS 24 license key to a new computer? I need to transfer my SPSS 24 license key to a new computer. I was able to download IBM® SPSS® Statistics Standard GradPack 24 for Windows (12-Mo Rental) onto the new computer, but every time I put in the activation code, I am met with this error message:

Authorization failed.: You are not allowed to generate any more new licenses.
End Of Transaction.
No additional authorizations are permitted on this code.
What should I do?

Answer: For installation & licensing issues on Student version and Graduate pack, contact your vendor.


IBM Setting a big session time-out value in DASH causes session lock-out - United States DASHL2; session; time-out; timeout; cannot login; locked out ; 2147483647; security.xml TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Using a big value (2147483647) for the session timeout setting in DASH, to achieve the maximum time between timeouts, is causing users to be locked out completely.

SYMPTOM
After entering the user ID and password in the login page, and then pressing the "continue" button,
the login page does not change, stuck at "processing" and then returns to the login page again."

All users get essentially locked out completely from DASH sessions.

CAUSE
In order to maximize the time between session timeouts, the customer is setting the timeout parameter in the security.xml file to 2147483647.

This timeout parameter used in the security.xml file is a WAS setting, but DASH is using a javascript call (settimeout), which causes a condition that prevents a login, if the timeout value is really big.

Note: 2147483647 is the maximum positive value for a 32-bit signed binary integer in computing.

RESOLVING THE PROBLEM
This condition that prevents logins can be averted by setting the custom property LTPAFIX in the consoleProperties.xml to "false".

Please follow this steps:

1. On DASH server, navigate to <JazzSM Home>/profile/config/cells/JazzSMNode01Cell/applications/isc.ear/deployments/isc/isclite.war/WEB-INF

2. Take a backup of consoleProperties.xml

3. Open consoleProperties.xml in edit-mode.

4. Search for "LTPAFIX" and change the value from "true" to "false".

Example:

Before
=====
<consoleproperties:console-property id="LTPAFIX" value="true"/>
</consoleproperties:ibm-portal-consoleproperties>

After
====
<consoleproperties:console-property id="LTPAFIX" value="false"/>
</consoleproperties:ibm-portal-consoleproperties>

5. Save the file.

6. Restart DASH server.

Question:
Why are the users unable to login to Web GUI 8.1 after I modify timeout to 2147483647 in security.xml file ?

I followed the Web GUI 8.1 reference guide here to switching off the session timeout

http://www-01.ibm.com/support/knowledgecenter/SSSHTQ_8.1.0/com.ibm.netcool_OMNIbus.doc_8.1.0/webtop/wip/task/web_adm_settimeout.html

After I edited /config/cells/JazzSMNode01Cell/security.xml file, modified timeout setting to 2147483647, users are not able to login anymore.

Answer:
1. On DASH server, navigate to <JazzSM Home>/profile/config/cells/JazzSMNode01Cell/applications/isc.ear/deployments/isc/isclite.war/WEB-INF

2. Take a backup of consoleProperties.xml

3. Open consoleProperties.xml in edit-mode.

4. Search for "LTPAFIX" and change the value from "true" to "false".

Example:

Before
=====
<consoleproperties:console-property id="LTPAFIX" value="true"/>
</consoleproperties:ibm-portal-consoleproperties>

After
====
<consoleproperties:console-property id="LTPAFIX" value="false"/>
</consoleproperties:ibm-portal-consoleproperties>

5. Save the file.

6. Restart DASH server.


IBM Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways (CVE-2015-0287, CVE-2015-0289, CVE-2015-0292, and CVE-2015-0293) - United States datapower; CVE-2015-0287; CVE-2015-0289; CVE-2015-0292; CVE-2015-0293 SECURITY BULLETIN

SUMMARY
 OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. IBM DataPower Gateway has addressed the corresponding applicable CVEs.

VULNERABILITY DETAILS
CVEID: CVE-2015-0287 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0287]
DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by an error related to the reuse of a structure in ASN.1 parsing. An attacker could exploit this vulnerability using an invalid write to corrupt memory and execute arbitrary code on the system.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101668 [https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101668] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVEID: CVE-2015-0289 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0289]
DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the failure to properly handle missing outer ContentInfo by the PKCS#7 parsing code. An attacker could exploit this vulnerability using a malformed ASN.1-encoded PKCS#7 blob to trigger a NULL pointer dereference.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101669 [https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101669] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2015-0292 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0292]
DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by an error when processing base64 encoded data. An attacker could exploit this vulnerability using specially-crafted base 64 data to corrupt memory and execute arbitrary code on the system and cause a denial of service.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101670 [https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101670] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVEID: CVE-2015-0293 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0293]
DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending a specially-crafted SSLv2 CLIENT-MASTER-KEY message, a remote attacker could exploit this vulnerability to trigger an assertion.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101671 [https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101671] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Note that the following vulnerabilities disclosed on the same day do not impact DataPower appliances:
CVEID: CVE-2015-0291 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0291]
CVEID: CVE-2015-0207 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0207]
CVEID: CVE-2015-0208 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0208]
CVEID: CVE-2015-0209 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0209]
CVEID: CVE-2015-0285 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0285]
CVEID: CVE-2015-0286 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0286]
CVEID: CVE-2015-0288 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0288]
CVEID: CVE-2015-0290 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0290]
CVEID: CVE-2015-1787 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1787]

AFFECTED PRODUCTS AND VERSIONS
IBM DataPower Gateway appliances all versions through 6.0.0.13, 6.0.1.9, 7.0.0.6, and 7.1.0.4

REMEDIATION/FIXES
Fix is available in versions 6.0.0.14, 6.0.1.10, 7.0.0.7. Refer to APAR IT07854 [http://www-01.ibm.com/support/docview.wss?uid=swg1IT07854] for [http://www-01.ibm.com/support/docview.wss?uid=swg1IT03868] URLs to download the fix.

This bulletin will be updated when a fix is made available for DataPower 7.1.x version.

For customers on DataPower 5.x versions, IBM recommends upgrading to a fixed, supported version of the product

WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator] OpenSSL Project vulnerability website [http://www.openssl.org/news/vulnerabilities.html] OpenSSL Advisory on above listed CVEs [https://www.openssl.org/news/secadv_20150319.txt]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/PSIRT] ACKNOWLEDGEMENT
None

CHANGE HISTORY
 15 May 2015: Updated status on 7.1.x
30 April 2015: Original Version Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways (CVE-2015-0289) I need to understand details regarding Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways (CVE-2015-0289). Where can I find this information?

Answer:
CVEID: CVE-2015-0289 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0289]
DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the failure to properly handle missing outer ContentInfo by the PKCS#7 parsing code. An attacker could exploit this vulnerability using a malformed ASN.1-encoded PKCS#7 blob to trigger a NULL pointer dereference.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101669 [https://exchange.xforce.ibmcloud.com/#/vulnerabilities/101669] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)


IBM Installing Rational Asset Analyzer Plug-in on Rational Developer for z/OS results in error CRIMA1071E - United States RAA; RAAi; Rdz; CRIMA1071E; 41580 TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Attempts to install IBM Rational Asset Analyzer (RAA) Plug-in (RAAi) for IBM Rational Developer for System z (RDz) results in the error CRIMA1071E.

SYMPTOM
You may receive a message similar to the following when installing RAAi in a RDz V9.0 environment:

IBM Rational® Asset Analyzer Plug-in for IBM Rational Developer for System z® 6.1.0.0 cannot be installed into any package group.

CRIMA1071E: The installation package 'IBM Rational® Asset Analyzer Plug-in for IBM Rational Developer for System z®' requires components supplied by other packages.
The required components might be supplied by the following installation packages:
Package: Rational® Developer for System z 7.6

CAUSE
The RAAi installation program does not yet support RDz 9.0.

RESOLVING THE PROBLEM
Install RAAi 6.1 into RDz 9.0 by manually copying the plug-in jar files to the Eclipsedropinsfolder.

Follow the steps below to install RAAi:

 1. Find the jar files by opening the RAAiInstallRepository.zip file and looking in thepluginsfolder for these two files:  * com.ibm.dmh.raai_*.jar
     * com.ibm.raa.integrate.doc_*.jar

 2. Find thedropinssubdirectory.  1. Right click on the properties to find the shortcut used to start RDz.
     2. Look at theTargetproperty to see where eclipse.exe resides
        For example: C:\Program Files\IBM\SDP

 3. Create a dropinssubdirectory if one does not exist.

 4. Copy the two jar files above to thedropinssubdirectory.

 5. Restart RDz (Run as administrator)

 6. Verify you have an Asset Analyzerentry in the left pane after RDz restarts by clicking on Window > Preferencesfrom the menu.

If you later wish to delete this copy of RAAi 6.1, simply remove the two plug-in jar files that you previously copied into the dropins subdirectory.

Cross reference information Segment Product Component Platform Version Edition Software Development Rational Asset Analyzer for System z

Question:
Installing RAA plugin in RDz  Hi,

I'm trying to install the RAA plugin in RDz.

But the installation manager mentions that it is not compatibble with an other package, in casu the IBM CICS Explorer SDK. But I would like to install both, is this not possible?

Answer:
Follow the steps below to install RAAi:

 1. Find the jar files by opening the RAAiInstallRepository.zip file and looking in thepluginsfolder for these two files:  * com.ibm.dmh.raai_*.jar
     * com.ibm.raa.integrate.doc_*.jar

 2. Find thedropinssubdirectory.  1. Right click on the properties to find the shortcut used to start RDz.
     2. Look at theTargetproperty to see where eclipse.exe resides
        For example: C:\Program Files\IBM\SDP

 3. Create a dropinssubdirectory if one does not exist.

 4. Copy the two jar files above to thedropinssubdirectory.

 5. Restart RDz (Run as administrator)

 6. Verify you have an Asset Analyzerentry in the left pane after RDz restarts by clicking on Window > Preferencesfrom the menu.


IBM Security Bulletin: WebSphere Message Broker and IBM Integration Bus are affected by denial of service vulnerability (CVE-2014-8901) - United States WMB IIB SECURITY BULLETIN

SUMMARY
 WebSphere Message Broker and IBM Integration Bus are affected by denial of service vulnerability. Pattern matching while validating a specially crafted XML document causes XML4C to consume 100% CPU

VULNERABILITY DETAILS
CVEID: CVE-2014-8901 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8901]
DESCRIPTION: IBM XML4J and XML4C libraries contain a denial of service vulnerability when loading specially crafted content. This causes the CPU to consume 100% of available resources and creates serious performance degradation to the system.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/99110 [https://exchange.xforce.ibmcloud.com/vulnerabilities/99110] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P)

AFFECTED PRODUCTS AND VERSIONS
WebSphere Message Broker V8

IBM Integration Bus V9 and V10

REMEDIATION/FIXES

Product VRMF APAR Remediation/Fix IBM Integration Bus V10 IT07064 An interim fix is available from IBM Fix Central for all platforms.
http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/Integration+Bus&release=All&platform=All&function=aparId&apars=IT07064 [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/Integration+Bus&release=All&platform=All&function=aparId&apars=IT07064]

The APAR is targeted to be available in fix pack 10.0.0.4 IBM Integration Bus V9 IT07064 An interim fix is available from IBM Fix Central for all platforms.
http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/Integration+Bus&release=All&platform=All&function=aparId&apars=IT07064 [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/Integration+Bus&release=All&platform=All&function=aparId&apars=IT07064]

The APAR is targeted to be available in fix pack 9.0.0.6 WebSphere Message Broker
V8
IT07064 An interim fix is available from IBM Fix Central for all platforms.
http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Message+Broker&release=All&platform=All&function=aparId&apars=IT07064 [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Message+Broker&release=All&platform=All&function=aparId&apars=IT07064]

The APAR is targeted to be available in fix pack 8.0.0.7
To mitigate the vulnerability, after an interim fix or fixpack containing IT07064 is applied you must set the following environment variable to disable the use of regular expressions by the MRM parser before starting the broker or integration node:

 * MQSI_DISABLE_REGEX_IN_XML4C=yes

For unsupported versions of the product IBM recommends upgrading to a fixed, supported version/release/platform of the product.

The planned maintenance release dates for WebSphere Message Broker and IBM Integration Bus are available at :
http://www.ibm.com/support/docview.wss?uid=swg27006308 [http://www.ibm.com/support/docview.wss?uid=swg27006308]

WORKAROUNDS AND MITIGATIONS
None known

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

ACKNOWLEDGEMENT
None

CHANGE HISTORY
 29-February-2016 - Original version Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

RELATED INFORMATION
 A Japanese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21978064]

Cross reference information Segment Product Component Platform Version Edition Business Integration WebSphere Message Broker 8.0
PRODUCT ALIAS/SYNONYM
 WMB IIB

Question: Help with Security Bulletin: WMB and IIB are affected by denial of service vulnerability (CVE-2014-8901) I need to understand details regarding Security Bulletin: WebSphere Message Broker and IBM Integration Bus are affected by denial of service vulnerability (CVE-2014-8901). Where can I find this information?

Answer:
CVEID: CVE-2014-8901 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8901]
DESCRIPTION: IBM XML4J and XML4C libraries contain a denial of service vulnerability when loading specially crafted content. This causes the CPU to consume 100% of available resources and creates serious performance degradation to the system.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/99110 [https://exchange.xforce.ibmcloud.com/vulnerabilities/99110] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P)


IBM Recommended values for web server plug-in config - United States  TECHNOTE (FAQ)

QUESTION
 In the web server plug-in, what do the LoadBalanceWeight, MaxConnections, ConnectTimeout, ServerIOTimeout, RetryInterval, IgnoreAffinityRequests, and GetDWLMTable options mean and what are the recommended settings for these options?

What affect does Session Affinity have?

How are connections handled during plug-in fail-over?

What is the effect of using more than one web server child process?

ANSWER
To understand how load balancing works in the web server plug-in, see Understanding IBM HTTP Server plug-in Load Balancing in a clustered environment [http://www.ibm.com/support/docview.wss?uid=swg21219567].

To understand how fail-over works in the web server plug-in, see Understanding HTTP plug-in failover in a clustered environment [http://www.ibm.com/support/docview.wss?uid=swg21219808].

LoadBalanceWeight is a starting "weight". The value is dynamically changed by the plug-in during runtime. The "weight" of a server (or clone) is lowered each time a request is assigned to that clone. When all weights for all servers drop to 0 or below, the plug-in has to readjust all of the weights so that they are above 0. Using a starting value of only 2 (default), means that the weights will get to 0 very quickly and the plug-in will constantly be readjusting the weights. Therefore, It is recommended to start with a higher LoadBalanceWeight. The IBM WebSphere Application Server administrative console will allow a value up to 20 for this. However, it is certainly possible to manually edit the plugin-cfg.xml file and specify some other value for LoadBalanceWeight that is higher than 20.

Note: At runtime, the LoadBalanceWeight of each appserver in a cluster are normalized by their highest common factor. For example, 100, 90, 80 have a common factor of 10. So, these configured weights would be divided by 10 at runtime, resulting in actual starting weights of only 10, 9, 8. Setting all clones to the same starting LoadBalanceWeight (for example: 20, 20, 20) will result in an actual starting weight of only 1 for each, because of normalization. So, it is recommended to set the weight of at least one of the clones to be off by a value of 1. For example, if there are 3 clones, you might choose the starting LoadBalanceWeights to be: 20, 20, 19. After normalization the weights will be unchanged.
Recommended values = all clones the same, except one clone off by one (for example: 20, 20, 19)

MaxConnections is used to gauge when a server is "starting to become overwhelmed". It is not used to determine when to fail-over (mark the server "down"). When a request is sent from the plug-in to the WAS appserver, it is called a "PendingRequest", until the response comes back. If the application running in WebSphere Application Server is handling requests quickly, each request will only be PENDING for a very short time. So, under ideal conditions, MaxConnections is not needed and therefore the default is (-1) meaning unlimited. However, sometimes an application may start to become overwhelmed and the application may not be able to handle the requests as quickly. Consequently Pending Requests start to build up. MaxConnections can be used to put a limit on the number of PENDING requests per server. When the MaxConnections limit is reached, the plug-in will stop sending requests to that appserver, but it is not marked down. The optimal value for MaxConnections will depend on how quickly the application and appserver respond to each request. If normal responses are returned in less than one second, it may be appropriate to set a low value for MaxConnections, like 20 or so. However, if it normally takes several seconds to get a response from the application, then it would be prudent to use a higher value for MaxConnections, like 100. Please note that if the MaxConnections limit has been reached the plug-in will not send ANY more requests to that server until responses come back for the current PENDING requests, and the pendingRequests count drops back down below the MaxConnections limit.
Recommended value = 20 - 100 depending on application response times

*Best Practices: with MaxConnections="-1" use LogLevel="Stats" to monitor the pendingRequests numbers in the plug-in log, under normal conditions. Then, choose a value for MaxConnections that is significantly higher than the highest number shown in the log. This method will help you to determine a MaxConnections value that is right for your specific environment.

ConnectTimeout means "how long should the plug-in wait when trying to open a socket to the Application Server"? If there are streams already open and available to the Application Server, the plug-in will use one of those. However, sometimes the plug-in needs to open a new stream to the Application Server. That should not take very long, so the value for ConnectTimeout should be very small. A ConnectTimeout value of 0 means never time-out. In that case, the time-out is left up to the OS TCP layer, which is NOT ideal. It is much better to specify a small positive number (like 5 seconds).
Recommended value = 5

ServerIOTimeout means "how long should the plug-in wait for a response from the application". After the socket is opened, the plug-in sends the request to the Application Server. The application processes the request and a response is sent back to the client, through the plug-in. How long should that take? What is reasonable, based on the application? There is no single correct answer here. It depends on the application. If the application is very quick to respond, then you can use a lower value for ServerIOTimeout. However, if the application requires more time to process the request (maybe to retrieve data from a database), then you should use a higher number for ServerIOTimeout. Using a value of 0 means that the plug-in will NOT time-out the request. This is often NOT ideal. A positive value means that the plug-in will NOT mark the appserver down after a ServerIOTimeout pops. So, if you want the plug-in to continue sending requests to the timed-out appserver, use a positive value. On the other hand, a negative value means that the plug-in WILL mark the appserver down after a ServerIOTimeout pops. So, if you want the plug-in to immediately mark the appserver down and fail-over to another appserver in the same cluster, use a negative value.
Recommended value = -900 (that is negative 900)

Note: The ability to use a negative ServerIOTimeout value was introduced in plug-in apar PK72097 [http://www-01.ibm.com/support/docview.wss?uid=swg1PK72097].

*Best Practices: use traces to determine the amount of time it takes for your application to respond to requests under normal conditions. Be sure to include the longest running requests that take the most time to respond. Then choose a value for ServerIOTimeout that is much larger (2X or 3X or more) than the longest response time. This method will ensure that your ServerIOTimeout is high enough to allow adequate time for the application to respond normally. Make it a negative value so that if the ServerIOTimeout pops, the plug-in will immediately mark the server down, and retry the request to a different appserver.

ServerIOTimeoutRetry can be used to decrease the number of retries after ServerIOTimeout has fired. By default, the Plug-in will try a request equal to the number of members in the cluster. For example, if the cluster has four members, and there is a ServerIOTimeout, the Plug-in will try it a second time. If the retry fails with ServerIOTimeout fired, then it will try a third time, and a fourth time if needed. But after four attempts, the Plug-in will give up and stop retrying. If you want to override this default behavior and reduce the number of retries after ServerIOTimeout, you can set ServerIOTimeoutRetry to a value that is less than the number of members in the cluster.
Recommended value = -1 (this is the default)

Note: This property was introduced by Plug-in apar PM70559 [http://www-01.ibm.com/support/docview.wss?uid=swg1PM70559].

RetryInterval is the time that the plug-in will wait before trying again to use an appserver that was marked down. The optimal value for RetryInterval depends on the number of appservers in the cluster, and the value used for ServerIOTimeout. You can use the following formula to determine the maximum RetryInterval value for your plug-in config:

(number of appservers in cluster - 1) x (absolute ServerIOTimeout) - 1

For example, if there are two appservers in the cluster, and the value of ServerIOTimeout is -900, then the maximum RetryInterval setting would be:
(2 - 1) x (900) - 1 = 899 seconds or less

Another example, if there are four appservers in the cluster, and the value of ServerIOTimeout is -900, then the maximum RetryInterval setting would be:
(4 - 1) x (900) -1 = 2699 seconds or less

Warning: Setting RetryInterval to a value higher than the recommended maximum, based on the formula above, can lead to an undesirable situation where all of the appservers in the cluster may be marked down simultaneously resulting in all requests temporarily failing.
Recommended value = 60 (this is the default)

Affinity requests are requests that contain a session cookie (ie. JSESSIONID). The session cookie is set by the Session Manager in WAS to ensure that all subsequent requests from the same client return to the same app server in the cluster. The session cookie contains the clone ID (or partition ID) of that specific app server. The web server Plug-in will look for the session cookie and use the clone ID to send the request to that specific WAS app server. An affinity request is not load balanced.

In the plug-in config there is a property called IgnoreAffinityRequests. This property determines if affinity requests will affect the load balance weights, or not. The default value for IgnoreAffinityRequests is True, which means that affinity requests will not have any affect on the load balance weights. This is best for environments where there are no, or few, affinity requests. On the other hand, for an environment with a lot of affinity requests, it may be better to set IgnoreAffinityRequests to False so that the load balance weights will accurately reflect the effect of having a lot of affinity requests.

Fail-over occurs when the plug-in marks a cluster member appserver (or clone) as "down", and then sends the pending requests to other members of the same cluster. This can happen if the plug-in is unable to open a new connection to the appserver within the ConnectTimeout. Or fail-over can happen if the plug-in has already sent the request to the appserver, but does not receive a response from the application within ServerIOTimeout. When the plug-in marks a cluster member appserver "down", it will handle the PENDING requests in one of two ways: Prior to plug-in apar PM12112 [http://www-01.ibm.com/support/docview.wss?uid=swg1PM12112], the plug-in would send all of the pending requests to the very next appserver in the cluster. However, after plug-in apar PM12112 [http://www-01.ibm.com/support/docview.wss?uid=swg1PM12112], the plug-in will randomly send the pending requests to any of the available appservers in the cluster. While the appserver is marked "down" the plug-in will no longer send any requests to it. After RetryInterval the plug-in will check to see if that appserver can be used successfully again. If so, the "down" flag will be removed and the appserver will be used again.

Note: By default, the number of attempts to handle a request is limited by the number of appservers in the cluster. For example, if there are only two appservers in the cluster, and the request fails once, the plug-in will only attempt that request one more time (total of two attempts). Or another example, if there are five appservers in the same cluster, and the request fails once, then the plug-in will attempt to retry that same request up to four more times (total of five attempts). That number includes retries sent to the same appserver (session affinity), or attempts sent to different appservers (fail-over).

Update: The plug-in apar PM70559 [http://www-01.ibm.com/support/docview.wss?uid=swg1PM70559] introduced a new setting called "ServerIOTimeoutRetry" that can be used to control the number of retries due to ServerIOTimeout.

If Memory-to-Memory (M2M) session replication is enabled in WebSphere Application Server, then the GetDWLMTable setting in the plug-in config must be changed to "true". Memory-to-Memory replication uses partition IDs rather than clone IDs. This can lead to broken session affinity if GetDWLMTable is set to false (which is the default). So it is very important to set GetDWLMTable="true" whenever using M2M in WebSphere Application Server.
Recommendation = GetDWLMTable="true" whenever M2M is used in WebSphere Application Server.

Each web server child process loads a separate instance of the web server plug-in. And multiple running instances of the web server plug-in do not share information with each other. For example if the IBM HTTP Server web server is configured to start 3 child processes (StartServers 3), then there will be 3 instances of the web server plug-in running (one for each IBM HTTP Server child process). The dynamically changing LoadBalanceWeight of each cluster member is not shared between the plug-in instances. So, in one instance of the plug-in "member1" might be considered UP with a weight of 5, when in another instance of the plug-in "member1" might be considered DOWN and unusable. This can result in possibly different behaviors depending on which child process / plug-in instance handles each incoming request. For this reason it is recommended that you should configure the web server to use only a few web server child processes with many threads on each. See Tuning IBM HTTP Server to maximize the number of client connections to WebSphere Application Server [http://www.ibm.com/support/docview.wss?uid=swg21167658].

If you choose to use more than one web server child process, keep in mind that the plug-in settings are handled on a per instance basis. For example, MaxConnections means the number of pending requests that will be allowed on that server, for each plug-in instance. If MaxConnections = 20, and there are 3 web server child processes (3 plug-in instances), then each instance will allow 20 pending connections to that Application Server for a total of 60 pending connections.

Related information
[http://g01zciwas003.ahe.pok.ibm.com/support/dcf/preview.wss?host=g01zcidbs003.ahe.pok.ibm.com&db=support/swg/swgtech.nsf&unid=E3B7487DDFB64D2C852574C00071DA95&taxOC=SSCC2GP&MD=2011/05/11%2011:05:12&sid=#]Understanding plug-in Load Balancing [http://www.ibm.com/support/docview.wss?uid=swg21219567]
Understanding plug-in Fail-over [http://www.ibm.com/support/docview.wss?uid=swg21219808]
Tuning IBM HTTP Server processes and threads [http://www.ibm.com/support/docview.wss?uid=swg21167658]
web server plug-in configuration [http://www.ibm.com/support/docview.wss?uid=swg21450051]
Modifying plug-in properties from the WebSphere Application Server administrative console [http://www.ibm.com/support/docview.wss?uid=swg21460889]
How do the properties ServerIOTimeout and PostBufferSize affect plug-in behavior? [http://www-01.ibm.com/support/docview.wss?uid=swg21408884]

Question: Why is WAS sending duplicate requests though our Portal application user clicks submit button only once? Is there any setting in WAS,Portal or IHS that can help prevent duplicate requests?

Answer: ServerIOTimeoutRetry can be used to decrease the number of retries after ServerIOTimeout has fired.


IBM Performance issue on Mac OS X Launching and Closing SPSS Statistics 21 or 22. - United States Mac OS X; Performance; open; close; exit; launch; 10.6.x 10.7.x 10.8.x 10.9.x TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 With SPSS Statistics 21 or 22 software installed on Mac OS X.
The software was running normally, but for what ever reason, the program might fail or close improperly by using Force Quit several times.

CAUSE
This has been identified as a product defect under APAR PM90266

ENVIRONMENT
This technote applies with any Mac OS X compatible with Statistics 21 or 22, Not version 23.

- IBM SPSS Statistics 21 release is supported on Apple Macintosh 10.6 (Snow Leopard), 10.7 (Lion), and 10.8 (Mountain Lion) with Intel processor.

- IBM SPSS Statistics 22 release is supported on Apple Macintosh 10.7 (Lion), and 10.8 (Mountain Lion) with Intel processor.
Note: IBM SPSS Statistics 22 for Macintosh (Mavericks, OSX 10.9 Operating System) is not officially supported until Statistics 22 FixPack 1 is released.

Note: Windows computers see
Technote 1652535
http://www-01.ibm.com/support/docview.wss?uid=swg21652535 [http://www-01.ibm.com/support/docview.wss?uid=swg21652535]

Note: For Statistics 23.0 Windows or Mac OS X, refer to technote: 1640411
http://www-01.ibm.com/support/docview.wss?uid=swg21640411 [http://www-01.ibm.com/support/docview.wss?uid=swg21640411]

DIAGNOSING THE PROBLEM
One or more of the following symptoms might occur that this resolution can solve.

(1) Statistics takes an abnormally longer time to start and close than when the software was initially installed.

(2) Very slow response and performance with using the software.

(3) The 'Data Editor' menu no longer appears under the Main menu bar.

RESOLVING THE PROBLEM
Delete the following file: com.ibm.spss.plist on your Macintosh to dramatically reduce the opening and closing of the Statistics software.

- You can delete it by opening the Finder and locate the Library/Preferences folder: /Library/Preferences/com.ibm.spss.plist
(1) Restart your Mac.
(2) Open 'Finder'.
(3) Select the 'Home' (house) icon (folder) in the left-hand pane.
(4) Select the 'Go' menu at top of screen.
(5) Press the 'Option' key. The list of menu options will now include 'Library'.
(6) Select the 'Library' menu option.
(7) Open the 'Preferences' folder.
(8) Rename the com.ibm.spss.plist object to old_com.ibm.spss.plist

- Another option is to use the Terminal application and do the following:
rm -fR ~/Library/Preferences/com.ibm.spss.plist

Finish and test your changes by doing the following:

(9) Launch Statistics
(10) Work with the program a bit.
(11) Close the software (It should be quicker, do not force quit)
(12) Re-launch Statistics
(13) Work with the program a bit.
(14) Close the software (do not force quit)
(15) Launch the software

NOTE: When you launch Statistics for the first time, it will take a little longer than subsequent launches, until you reboot your computer again. This is related to Java initialization routines.

- FYI: Additionally, if you are using Mac OSX Mavericks 10.9.x, you need to stop the process that protects this file and restores it (it is deleted):

Since OSX 10.9.x Mavericks a cached copy of your "plist" file is stored that uses a background process: CFPREFSD
Deleting the "plist" file and restarting SPSS Statistics does not create a new copy of these files.
Rather, Mavericks restore its cached copy.
Only by stopping the "cfprefsd" process and starting SPSS Statistics, will it generate a new "plist" preference file and default toolbar.

When you go to Finder - Applications - Utilities and open Activity Monitor on the 10.9.x computer you see that there is a CFPREFSD process visible for root user and for the current logged in user.
You need to stop the CFPREFSD process for the current user. Do so in the Terminal application by running the following command:

killall -u {CURRENT_USER} cfprefsd

Where {CURRENT_USER} is replaced with the person's user ID. One can get the user ID by typing "whoami" at a Terminal prompt.

Should removing these files and running the program does not resolve the issue, you might need to remove all of them and reinstall the program.

RELATED INFORMATION
 Need more help? Our Statistics forum is Live! [https://developer.ibm.com/answers/topics/statistics.html?smartspace=predictive-analytics]

Question:
SPSS will not start on Mac

I downloaded SPSS about 3 weeks ago. On the day when I downloaded it, it was working fine. Last week, I tried starting SPSS but it did not start. I tried reinstalling it, it still would not open. I've updated JAVA (thought this would be a problem), it slowly opened the program but then now that I have reinstalled it and entered in my code, I've used up my code and I have no authorization. But just now, I started SPSS and the same problem is happening. The IBM SPSS name screen appears but nothing happens.

    SPSS would not start.

    Even if it does start, I have licensing problems.

Answer: Delete the following file: com.ibm.spss.plist on your Macintosh to dramatically reduce the opening and closing of the Statistics software.


IBM Datacap Taskmaster Capture ICR error code 12 - United States RecognizeFieldICR_C; Recostar; 12 TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 When performing field level ICR recognition using the action RecognizeFieldICR_C (), the batch aborts with error code 12.

SYMPTOM
From log file:

Executing 'RecognizeFieldEx' from 'Datacap.Recognition.Recostar.ICRCWrapperClass'. Parameter : <FieldName>
Recognition return status: 12(Not defined (not used))

CAUSE
The c_cr variable for ICR_C recognition is not set for the engine.

RESOLVING THE PROBLEM
In Datacap Studio, set the c_cr variable to USA prior to the call to recognition as follow:

SaveAsCurrentObjVariable("c_cr", "USA")
RecognizeFieldICR_C

Question:
RecognizePageFieldsICR_C aborts with Page Type change  I have an DeveloperWorks application that runs: Survey. In the application PageID Task there is a function that sets the Page Type to ReliefForm (based on a barcode)

Does anyone know why when I change the SetPageType to set another name, the RecognizePageFieldsICR_C in the Profiler Task aborts? If I put the name back the action runs fine.

Answer:
In Datacap Studio, set the c_cr variable to USA prior to the call to recognition as follow:

SaveAsCurrentObjVariable("c_cr", "USA")
RecognizeFieldICR_C


IBM Guardium STAP does not connect properly and does not show in the S-TAP Control - I see some specific errors in some log files. - United States  TECHNOTE (FAQ)

QUESTION
 What can cause an STAP to fail to connect properly - I get the following messages in the logs:-

/tmp/guard_stap.stderr.txt on the DB Server :-
"Server <ip_addr> wasn't heard from for nn sec during this attempt (nnn sec total), closing and re-opening"

and from the Guardium Appliance - via fileserver in the /log/opt-ibm-guardium-log/snif/snif.log
"Unauthorized client connecting from <ip_addr> ,rejecting"

CAUSE
One reason for these errors could be that the S-TAP Approval Needed is checked in the S-TAP Certification screen on the Appliance like this :-
[/support/docview.wss?uid=swg22009818&aid=1] [/support/docview.wss?uid=swg22009818&aid=1]

ANSWER
Uncheck the Approval box and the S-TAPs should start connecting .

[/support/docview.wss?uid=swg22009818&aid=2] [/support/docview.wss?uid=swg22009818&aid=2]

Question:
Installed an STAP on a DB Server but it does not show up on my Appliance in S-TAP Control etc

Installed an STAP on a DB Server but it does not show up on my Appliance in S-TAP Control etc

I get the following messages in the logs:-

/tmp/guard_stap.stderr.txt on the DB Server :- "Server wasn't heard from for nn sec during this attempt nnn sec total), closing and re-opening"

and from the Guardium Appliance - via fileserver in the /log/opt-ibm-guardium-log/snif/snif.log "Unauthorized client connecting from ,rejecting".

How do I correct the problem?

Answer: Uncheck the Approval box and the S-TAPs should start connecting .


IBM Security Bulletin: IBM WebSphere MQ is affected by a vulnerability in GSKit (CVE-2014-0076) - United States  SECURITY BULLETIN

SUMMARY
 A vulnerability in GSKit, which is included in IBM WebSphere MQ, can potentially allow key information about certain kinds of binary type Elliptic Curves used in Digital signatures during signing operations.

VULNERABILITY DETAILS
CVE-ID: CVE-2014-0076 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0076]
DESCRIPTION: An attacker running a program on the same machine as where the victim is running a program could use CPU timing information to discover key information about certain kinds of binary type Elliptic Curves used in Digital signatures during signing operations. Although GSKit only generates Prime type Elliptic Curves, externally generated keys may be imported in GSKit.
From WebSphere MQ version 7.1, GSKit version 8.0 is integrated with WebSphere MQ. For WebSphere MQ 7.0.1, GSKit version 7 or version 8 was installed separately.

CVSS Base Score: 2.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/91990 [https://exchange.xforce.ibmcloud.com/vulnerabilities/91990]
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)

AFFECTED PRODUCTS AND VERSIONS
IBM WebSphere MQ 8.0, including all maintenance levels.

IBM WebSphere MQ 7.5, including all maintenance levels.

IBM WebSphere MQ 7.1, including all maintenance levels.

IBM WebSphere MQ 7.0.1, maintenance levels from 7.0.1.4 onwards, using GSKit version 8.0.

REMEDIATION/FIXES
IBM strongly recommends that Elliptic Curve CipherSpecs are not used. These CipherSpecs have names starting with 'EC'.

A summary of MQ CipherSpecs and protocols can be found in the IBM Knowledge Center Specifying CipherSpecs [http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.sec.doc/q014260_.htm] topic.

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 03 November 2014: Original Copy Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

RELATED INFORMATION
 A Japanese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21689211]

Question: Help with Security Bulletin: IBM WebSphere MQ is affected by a vulnerability in GSKit (CVE-2014-0076) I need to understand details regarding Security Bulletin: IBM WebSphere MQ is affected by a vulnerability in GSKit (CVE-2014-0076). Where can I find this information?

Answer:
CVE-ID: CVE-2014-0076 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0076]
DESCRIPTION: An attacker running a program on the same machine as where the victim is running a program could use CPU timing information to discover key information about certain kinds of binary type Elliptic Curves used in Digital signatures during signing operations. Although GSKit only generates Prime type Elliptic Curves, externally generated keys may be imported in GSKit.
From WebSphere MQ version 7.1, GSKit version 8.0 is integrated with WebSphere MQ. For WebSphere MQ 7.0.1, GSKit version 7 or version 8 was installed separately.

CVSS Base Score: 2.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/91990 [https://exchange.xforce.ibmcloud.com/vulnerabilities/91990]
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)


IBM Security Bulletin: Cross-site scripting vulnerabilities in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) error handling (CVE-2015-0193) - United States  SECURITY BULLETIN

SUMMARY
 IBM Business Proccess Manager is vulnerable to cross-site scripting, caused by improper neutralization of user-supplied input in some error situations. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

VULNERABILITY DETAILS
CVEID:CVE-2015-0193 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0193]
DESCRIPTION:IBM Business Proccess Manager is vulnerable to cross-site scripting, caused by improper neutralization of user-supplied input in some error situations. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS Base Score: 3.5
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/101009 [https://exchange.xforce.ibmcloud.com/vulnerabilities/101009]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

AFFECTED PRODUCTS AND VERSIONS

 * IBM Business Process Manager Standard V7.5.x.x through 8.5.5.0
 * IBM Business Process Manager Express V7.5.x.x through 8.5.5.0
 * IBM Business Process Manager Advanced V7.5.x.x through 8.5.5.0
 * WebSphere Lombardi Edition 7.2

If you are using an older unsupported version, IBM strongly recommends to upgrade. REMEDIATION/FIXES
Install the interim fix for APAR JR52626 as appropriate for your current IBM Business Process Manager or WebSphere Lombardi Edition version.

 * IBM Business Process Manager Express [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+Business+Process+Manager+Express&release=All&platform=All&function=aparId&apars=JR52626]
 * IBM Business Process Manager Standard [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+Business+Process+Manager+Standard&release=All&platform=All&function=aparId&apars=JR52626]
 * IBM Business Process Manager Advanced [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+Business+Process+Manager+Advanced&release=All&platform=All&function=aparId&apars=JR52626]
 * WebSphere Lombardi Edition [http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/WebSphere+Lombardi+Edition&release=All&platform=All&function=aparId&apars=JR52626]

WORKAROUNDS AND MITIGATIONS
As a pre-caution, advise users not to click links in email.

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 2015-05-27 - initial version published
2015-10-07 - updated version numbers

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Cross reference information Segment Product Component Platform Version Edition Business Integration IBM Business Process Manager Standard Security AIX, Linux, Linux zSeries, Solaris, Windows 8.5.5, 8.5.0.1, 8.5, 8.0.1.3, 8.0.1.2, 8.0.1.1, 8.0.1, 8.0, 7.5.1.2, 7.5.1.1, 7.5.1, 7.5.0.1, 7.5 Business Integration IBM Business Process Manager Express Security Linux, Linux zSeries, Windows 8.5.5, 8.5.0.1, 8.5, 8.0.1.3, 8.0.1.2, 8.0.1.1, 8.0.1, 8.0, 7.5.1.2, 7.5.1.1, 7.5.1, 7.5.0.1, 7.5 Business Integration WebSphere Lombardi Edition Security AIX, HP-UX, Linux, Linux zSeries, Linux/x86, Solaris, Windows, Windows Vista, Windows XP 7.2.0.5, 7.2.0.4, 7.2.0.3, 7.2.0.2, 7.2.0.1, 7.2

Question: Help with Security Bulletin: Cross-site scripting vulnerabilities in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) error handling (CVE-2015-0193) I need to understand details regarding Security Bulletin: Cross-site scripting vulnerabilities in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) error handling (CVE-2015-0193). Where can I find this information?

Answer:
CVEID:CVE-2015-0193 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0193]
DESCRIPTION:IBM Business Proccess Manager is vulnerable to cross-site scripting, caused by improper neutralization of user-supplied input in some error situations. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS Base Score: 3.5
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/101009 [https://exchange.xforce.ibmcloud.com/vulnerabilities/101009]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)


IBM Recognition gives Word too tall error with IBM Datacap Taskmaster Capture - United States recognition OCR OCR_A OCR_S TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 When performing recognition on an image, recognition fails. The RRS log entry shows:

Word too tall, removed.

CAUSE
This error can occur when the height of the word in pixels exceeds the configured limit. It can also occur when the recognition engine cannot identify the boundaries of the word.

RESOLVING THE PROBLEM
Do one of the following as appropriate for the situation.

 * Verify that the newest recognition engine is being used. Currently this is done using the RecognizePageOCR_S action from the ocr_sr library.
 * Increase the height limit for the action using SetMaxCharacterHeightTMM(x) where x represents the height in pixels. Default depends on the DPI, but for 300 DPI is 64.
 * Reduce the height of the word in pixels. This may be done either by making the word smaller, or by reducing the number of pixels per inch for the tiff.

Question:
OCR Results for Bold fonts

Hi all,

I am having issue with extracting front that are bold, big front. May I know if Datacap have limitation on capturing metadata with big, bold front such as title of the document. I am using RecognizePageOCR_A for extraction of meta data and every other words were being extracted fine except those that are big. The attachment are the sample of front that could not be captured.

Answer:
Do one of the following as appropriate for the situation.

 * Verify that the newest recognition engine is being used. Currently this is done using the RecognizePageOCR_S action from the ocr_sr library.
 * Increase the height limit for the action using SetMaxCharacterHeightTMM(x) where x represents the height in pixels. Default depends on the DPI, but for 300 DPI is 64.
 * Reduce the height of the word in pixels. This may be done either by making the word smaller, or by reducing the number of pixels per inch for the tiff.


IBM DOORS module fails to open in exclusive edit mode results in error "unable to open module ...no such file or directory" - United States missing session file; file not found; can not open module; open module exclusive edit fails; PM50525 TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Attempts to open a module exclusive edit in IBM Rational DOORS result in the error "DOORS report
Unable to open module '/A Project/Requirements' No such file or directory".

SYMPTOM
A module with a large number of sections is used mostly in shareable edit mode.

You can open the module Read-only , or Shareable-Edit; but not in exclusive edit.

Steps to reproduce:

 1. Login to DOORS

 2. Click the Project, or folder, icon that contains the module

 3. Click the module icon in the DOORS Explorer window

 4. Click File > Open> Exclusive Edit (Ctrl + E)

Expected result: The module should open in Exclusive edit mode.

Actual result: The module will not open in exclusive edit module; however it will open in read only mode, or shareable edit mode. If you attempt to check the database integrity for issue the module is not flagged for any problems.

The full error message is as follows:

DOORS report
Unable to open module '/A Project/Requirements' No such file or directory"
C:\Program Files (x86)\IBM\Rational\DOORS\9.5\data\v6data\20\m00000021.mod\current.ver\s1000005.dtc

image

[/support/docview.wss?uid=swg21511831&aid=1] [/support/docview.wss?uid=swg21511831&aid=1]

CAUSE
 This issue has been identified as a product defect under APAR PM50525 [http://ibm.com/support/docview.wss?uid=swg1PM31236].

RESOLVING THE PROBLEM
This error indicates that a user session file is corrupted on the database server.

This defect is resolved in IBM Rational DOORS Version 9.4.0.1 [http://www-01.ibm.com/support/docview.wss?uid=swg27036720#9401]

WORKAROUND:

the following options can be used to correct this problem:

 * Retrieve the missing file from system backup and insert it into the module current.ver directory

   The advantage of inserting the missing session file is you do not need to restart the database server.

Warning these two option should only be performed by Rational Support. Modifications to the files in your DOORS database could result is data corruption and jeapordize your DOORS database. Send the session.ixc file to support for repair

From the module directory listed in the error message provide support the file session.ixc
Choosing to have support repair the session index file requires you to have all users log out
and shut down the DOORS database server until the repaired file is returned and inserted
to replace the existing data file for the module.

Create a replacement session file
From the module directory listed in the error message provide support the file session.ixc
Adjacent session files will be required in order to to create the replacement.
Your support engineer will identify these files from the session index file.
No work can be performed in the effected module until the replacement session file is restored
for the effected module.

Note: Generally the repair is only required for one user session file. However in circumstances where DOORS reports a missing session file for a module- the event that caused this may have effected session files for other users connected to the module. For this situation you may need to perform a successive repair to the index file.

Question:
Cannot open module in exclusive edit - (no such file or directory)  Hello.

I have a module, that I can open normally, but when I try to open it in Exclusive Edit it tells me that "no such file or directory"

What does this mean?

Answer:
This error indicates that a user session file is corrupted on the database server.

This defect is resolved in IBM Rational DOORS Version 9.4.0.1


IBM Can IBM Content Navigator be installed on Windows and be deployed to an Application Server that is running on a Unix Platform. - United States  TECHNOTE (FAQ)

QUESTION
 Can IBM Content Navigator be installed on Windows and be deployed to an Application Server that is running on a Unix Platform.

ANSWER
This is not a supported configuration.

Question: Can IBM Content Navigator be installed on Windows and be deployed to an Application Server that is running on a Unix Platform? Can IBM Content Navigator be installed on Windows and be deployed to an Application Server that is running on a Unix Platform?

Answer: This is not a supported configuration.


IBM Client IP address missing from the X-Forwarded-For header - United States  TECHNOTE (FAQ)

QUESTION
 Why is the Front End Load Balancer ( FELB ) not forwarding a client IP address to a backend?

ANSWER
This is a known limitation in the current implementation of haproxy ( FELB ), especially with the layer 7 where SSL termination is handled.
Notice that forwarding a client IP address to a backend works when the FELB is setup to use non-SSL configuration.

Question: If we need to log client ip, if the FELB is enabled,  does it still need enable x-forwarder-for? If we need to log client ip, if the FELB is enabled,  does it still need enable x-forwarder-for?

Answer:
This is a known limitation in the current implementation of haproxy ( FELB ), especially with the layer 7 where SSL termination is handled.
Notice that forwarding a client IP address to a backend works when the FELB is setup to use non-SSL configuration.